Static files & security

When using static files for resources does it matter where they are stored? Are there any security issues that could arise from having them inside the root directory? Hopefully not, as moving them outside the root for what I'm currently doing would be a bit of a pain.

Thanks

I'm not going to claim to know for certain but I believe if you keep your permissions correct so those files are non-world readable you are ok. This is actually something I've also wondered myself.

Depends on what's in the files, doesn't it?

If you don't want users to stumble across the files that run behind your static resources, you'll need to take measures to prevent that. Perhaps by permissions, though moving outside of the webroot would have my preference.

If your static resources are just PDFs you are distributing.. then what's the security risk in having them web accessible too (other than the less-than-ideal duplicate content)?

Hi, thanks for the replies, I should have been a bit more specific. I was meaning templates and chunks as external files, then in the manager the "is static" is checked and external file is selected.

I've also used .htaccess to password protect an assets/protected folder (which is not Mark's preference).

How unsafe would the following be put as .htaccess in the folder where the static files are saved?



does it really need password protection?

Should be fine. In fact, if you use static elements in the default location (core/components/), there is already an ht.access file in core/ with that directive ready to us; and you should already be using that with the core.

So how would this be done in the Cloud, which uses nginx?

Quote from: sottwell at Nov 30, 2012, 10:32 PM

So how would this be done in the Cloud, which uses nginx?

Using a simple location match...

...which you can request be applied at the moment, though we may add this as a configuration option in the dashboard (or similar) at some point soon.